API Version 1.2

This documentation explain how to register, configure, and develop your app so you can successfully use our APIs

Create App

In order for your app to access our APIs, you must register your app using the App Dashboard. Registration creates an App ID that lets us know who you are, helps us distinguish your app from other apps.

1. You will need to create a new App Create New App
2. Once you created your App you will get your app_id and app_secret

OAuth 2.0 / OpenID Connect

Register an app at Create New App and set its Redirect URL. Use the generated App ID as client_id and App Secret as client_secret. The redirect URL in requests must exactly match the registered URL.

1. Send the user to the authorization URL in a browser. Replace the placeholders and URL-encode your registered redirect URL. Save a random state in the user's session.

   https://nongki.nchat.cc/oauth/authorize?response_type=code&client_id=YOUR_APP_ID&redirect_uri=https%3A%2F%2Fapp.example.com%2Fcallback&scope=openid%20profile%20email&state=RANDOM_STATE

2. After approval, the browser returns to https://app.example.com/callback?code=RETURNED_CODE&state=RANDOM_STATE. Check that state matches the saved value. The code can be exchanged only once.
3. Exchange the code from your server. Keep the App Secret on the server; never place it in browser JavaScript.

   curl -X POST 'https://nongki.nchat.cc/oauth/token' \
   				  -d 'grant_type=authorization_code' \
   				  -d 'client_id=YOUR_APP_ID' \
   				  -d 'client_secret=YOUR_APP_SECRET' \
   				  -d 'code=RETURNED_CODE' \
   				  --data-urlencode 'redirect_uri=https://app.example.com/callback'

   The JSON response contains access_token, token_type (Bearer), expires_in (3600 seconds), and id_token. Only the authorization code grant is supported; there is no refresh token endpoint.
4. Request the user's profile with the access token:

   curl -H 'Authorization: Bearer ACCESS_TOKEN' 'https://nongki.nchat.cc/oauth/userinfo'

   The response includes sub, preferred_username, name, email, and picture.

The ID token uses HS256 with your App Secret. The /oauth/jwks endpoint currently returns no public keys, so clients that require JWKS-based verification cannot use it. Supported scopes are openid, profile, and email.

Legacy app API

Existing integrations can continue to use /api/oauth?app_id=YOUR_APP_ID. That flow returns auth_key, which your server exchanges by POST to /api/authorize using app_id, app_secret, and auth_key. Read the profile from /api/get_user_info?access_token=ACCESS_TOKEN. This is a separate flow; use code with /oauth/token for OAuth 2.0.